Pirates Hacked Shipping Firm's CMS To Plan Attacks, Find Valuable Cargo (softpedia.com)
An anonymous reader writes: Verizon's most recent Data Breach Digest includes a curious hacking case. Apparently a group of sea pirates have hired a hacker who uploaded a Web shell to a shipping company's CMS that allowed them to download cargo inventories and ship routes. They then used this information to attack ships, equipped with a barcode reader (and weapons of course), searching specific crates, emptying all the high-value cargo, and making off with the loot within minutes of launching their attacks.
No, Islam and all Muslims are Satan's shit.
You are not allowed to say bad things about the people that would like to see your way of life destroyed.
We need a 50 ft sea wall to keep them all in Mexico.
Now that we are referring to netflix subscribers by the same name we may need to come up with another name for people who steal at sea. What should we call them? Searates? Picaroons? Thieves?
Minimum threshold fixed. Thanks!
It's fucking ludicrous that a vessel carrying a billion dollars worth of cargo isn't protected by at least a pair of .50 caliber Gatling guns. These pirates should be getting turned into a red mist at 500 yards.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
b careful u dudes o_O
Wouldn't this be down as acceptable behavior?
"hacker who uploaded a Web shell to a shipping company's CMS"
What was the name of this CMS and who originally installed it?
Apparently a group of sea pirates have hired a hacker who uploaded a Web shell to a shipping company's CMS that allowed them to download cargo inventories and ship routes. They then used this information to attack ships,
That sounds like a lot of work. Haven't these pirates heard of torrents?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
every round, a certain country with rare sources of phpproxy are the gate. but the matrix is only comm between the non sick
Although interesting on the surface, that softpedia piece reads like it was written by Verizon PR. No surprise, since the "article" is basically a regurgitation of the Verizon "whitepaper" most likely regurgitated by someone who has none to a basic understanding of pen testing and web security:
"With all this information in hand, Verizon helped the company block the hacker's IP, remove the Web shell, take down its server, reset passwords for all compromised accounts, and upgrade the CMS."
And the world was great again. Right?
"For instance, we found numerous mistyped commands and observed that the threat actors constantly struggled to interact with the compromised servers."
Next time you won't be so lucky ... or alternatively, what about the more l33t sk1ll3d that are still inside the shipping company network who Verizon didn't find?
"Additionally, as a sign of their lack of skills, the attacker also didn't use a proxy or VPN and exposed their home IP address."
Send in the drones?
Interesting angle but poorly written article that blows smoke so far up Verizon's ass that it comes out their nose. Based on the descriptions of how incompetent the hackers were, OPM could have figured this one out. Hardly a ringing endorsement of Verizon RISK team.
100 REM PISS OFF CODE FASCISTS 200 GOTO 100
They are sea pirates you say? And here I was, thinking maybe they were space pirates.
Sounds like something straight from a William Gibson or Neal Stephenson novel. Crafty little beggars, you have to give them that.
We suffer more in our imagination than in reality. - Seneca
upon boarding the ship, the lead pirate announced, "Me scurvy dogs and me be after yer booty so we're scannin all yer baaarrrcodes."
Anons need not reply. Questions end with a question mark.
Must be the laid off Disney IT workers....
Must be the laid off Disney IT workers....
From the article:
...the firm's outdated custom-built CMS, which featured an insecure upload script...
So, there you go. Proof that security by obscurity doesn't work.
This paragraph from here is noteworthy https://icc-ccs.org/piracy-reporting-centre/advice-to-masters:
"In most incidents pirates and armed robbers will abandon an attack when they know they been spotted or feel the vessel has been secured and is a difficult target. However Somali and Nigerian pirates tend to be more aggressive so additional precautions must be taken."
Coincidence that most of the immigrants responsible for the NYE crimes in Germany were from that region?
if you've got that much access, why not just reassign valuable packages/containers deliveries to addresses or shipping companies you control in,and just drive the goods away. Who looks inside a shipping container at a dock anyway? Pick random/breakable commodities of modest value and the company might never twig anything was wrong until you had made off with millions. I don't see the advantage in storming a supercarrier in a small boat and making off with handfuls of jewlery when you could have an entire container delivered to your front door.
Coincidence that most of the immigrants responsible for the NYE crimes in Germany were from that region?
I might be wrong, but didn't they say those guys (responsible for the NYE crimes) were from *northern* africa?
Pirates have been using Intel since the days of Henry Avery https://en.wikipedia.org/wiki/... and undoubtedly before
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
Set up fake data and lure them to attack freighters loaded with armed troops.
Go back to Saudi Arabia you terrorist lover !
that will fix it
Just like bees, you gotta avoid the Africanized pirates due to their aggressiveness.
How is that different from others bashing Christians?
Don't blame me for redundant posts. I can't type very fast. Hence the user ID.
I've worked in the Supply Chain / Shipping world for over 10 years now and have seen incidents like this multiple times.
One of the more memorable ones was where someone in the container yard in China was breaking into the containers and skimming product from the cartons inside the containers. In order to try and go undetected they were peeling off the carton labels that were printed out from our tracking system and reprinting the labels from a local device to reflect the new unit counts after they stole several items from each carton.
We ended up finding out about this because when the goods were received at the customer's distribution center they were complaining that they were scanning the same carton into their receiving system over and over again. Turned out that the guys printing the labels got the quantities right and the carton numbers correct and aped the design fairly closely, but couldn't figure out how to adjust the barcode on the label so they were reprinting the same carton barcode number over and over.
Even after showing the customer the print logs of the actual labels that were printed from our system (and how the barcodes were not repeating there), and showing them the minor positioning difference in the labels and showing them the actual shipment amounts that should have been in the cartons they STILL claimed our system was printing labels wrong for months. They literally told us that thieves weren't sophisticated enough to do what we were telling them was happening. They finally believed us when they got a batch of cartons where the skimmers got lazy and just pasted their reprinted labels over top of ours.
It's not piracy... it's infringement of copyright! Piracy is... oh wait, never mind, yep, it's totally piracy. Sorry about that.
The shipping line in question is MSC - The Mediterranean Shipping Company
A global operation despite the name.
Security in shipping is an absolute joke. Working at a shipping company it was taking several months to escalate my privileges on our main system. I asked my manager if I could look at her account and noticed that I just needed to add a number to a text file in my home directory like she had. Problem solved and she was happy because now she could delegate all sorts of work to underlings only she was supposed to be doing.
Easy. Get a bunch of guns to defend the ship as it sails thru the pirate waters. When it approaches a country where guns are not legal,
throw them overboard (or melt them). The cost, compared to the alternative, is trivial.
even after reading the article I have no idea what a "Web shell" is... ???
These people are not being "bashed", they are being condemned for the actions of a few. No-one is claiming all Christians are savage terrorists because the IRA was made up of Christians, yet Muslims have to put up with this endlessly.
I understand why you think "Oh this bashing of one religion is not accepted, but the bashing of another one is - what gives?", but to ignore the precise nature of the "bashing" going on, and the context in which this "bashing" is happening will only lead you to the wrong conclusion.
Mindless attacks are never appropriate, regardless of the target (Christianity, Islam, etc.).